> ## Documentation Index
> Fetch the complete documentation index at: https://help.nops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and authentication

> nOps protects your data with enterprise-grade authentication — including SSO/SAML, MFA, SCIM provisioning, configurable session policies, and strict multi-tenant data isolation.

## Overview

nOps uses an enterprise-grade authentication platform under the hood. It provides OAuth, magic link, SSO/SAML, SCIM directory sync, and multi-factor authentication — giving your organization the flexibility to choose the sign-in experience that fits your security requirements.

All authentication, session management, and identity provisioning are handled by this platform, so nOps never stores passwords directly.

## Signing in

nOps uses an **email-first** sign-in flow. The experience adapts based on whether your organization has SSO configured.

<Steps>
  <Step title="Enter your email">
    On the sign-in page, enter your work email address and click **Continue**.
  </Step>

  <Step title="Choose your sign-in method">
    nOps checks whether your email domain has an SSO connection configured:

    * **SSO available**: You see a **Sign in with SSO** button. If SSO is not enforced, you also have the option to **Send magic link instead**.
    * **No SSO**: You are redirected to the magic link flow automatically. Check your inbox for a sign-in link or enter the 6-digit verification code.
  </Step>

  <Step title="OAuth providers">
    Below the primary sign-in method, OAuth buttons are shown for **Google** and **Microsoft**. Your administrator may also enable **GitHub** and **Apple** sign-in.

    A **Last used** badge appears on the provider you used most recently, so you can quickly sign in the same way again.
  </Step>
</Steps>

<Tip>
  If your organization enforces SSO, social and magic-link sign-in are disabled for all members. You must authenticate through your corporate identity provider.
</Tip>

## Signing up

New organizations are created through the sign-up page.

<Steps>
  <Step title="Enter your details">
    Provide your **Organization name** and **work email address**. Public email domains (gmail.com, yahoo.com, outlook.com, hotmail.com, and others) are blocked — a company email is required.
  </Step>

  <Step title="Verify your email">
    You are redirected to the verification flow. Check your inbox for a magic link or enter the verification code.
  </Step>

  <Step title="Complete setup">
    Once verified, nOps creates your organization and takes you to the dashboard. You can also sign up with **Google** or **Microsoft** OAuth instead of the email flow.
  </Step>
</Steps>

## Setting up SSO

SAML single sign-on lets your team authenticate through a centralized identity provider (Okta, Azure AD, Google Workspace, and others). Administrators configure SSO from the security settings page using a secure setup portal.

<Note>
  The security settings page (and SSO/SCIM setup) requires the **Inform** plan.
</Note>

<Steps>
  <Step title="Open security settings">
    Go to **Settings > Security**.
  </Step>

  <Step title="Invite your IT admin">
    Click **Invite IT Admin to Configure Features**. A modal opens where you select which features to configure:

    * **Domain Verification** — verify ownership of your email domain
    * **Single Sign-On** — configure SAML/OIDC (requires domain verification)
    * **Directory Sync** — enable SCIM user provisioning
    * **Audit Logs** — enable audit log streaming
    * **Log Streams** — configure external log destinations
  </Step>

  <Step title="Send or generate the link">
    Enter your IT admin's email address and click **Send Invite**, or click **Generate Links** to copy a portal link manually. The link expires in **5 minutes**.
  </Step>

  <Step title="IT admin configures the connection">
    Your IT admin opens the setup portal link and configures the SAML connection in your identity provider. They map the required attributes and test the connection.
  </Step>

  <Step title="Verify the results">
    Back on the security settings page, the status badges update to reflect the configuration:

    * **Domain Verification**: Verified / Not Verified
    * **Single Sign-On**: Active (with provider name and connection date) / Not Configured
    * **Directory Sync (SCIM)**: Active (with provider name) / Not Configured
  </Step>

  <Step title="Enforce SSO (optional)">
    To require SAML for all users and disable magic-link and social sign-in, contact nOps support to enable SSO enforcement for your organization.
  </Step>
</Steps>

## Security settings page

Administrators can manage authentication from **Settings > Security**. The page includes the following sections:

### Security features card

A summary card showing the current status of each security feature:

| Feature                   | Status indicators                                   |
| ------------------------- | --------------------------------------------------- |
| **Domain Verification**   | Verified or Not Verified                            |
| **Single Sign-On**        | Active (provider, connected date) or Not Configured |
| **Directory Sync (SCIM)** | Active (provider) or Not Configured                 |
| **Audit Logs**            | Active or Not Configured                            |

### API keys

Create and manage API keys for programmatic access to nOps directly from the settings page.

### Audit logs

Administrators can:

* **Enable audit logging** — toggle audit event collection on or off
* **Set retention** — choose how long audit logs are kept (30, 60, 90, 180, 365, or 730 days)
* **Export logs** — download audit log data as a file for compliance or analysis

## Multi-factor authentication

Multi-factor authentication is built in. Depending on your organization's configuration, users may be prompted for a time-based one-time password (TOTP) or other supported factors during sign-in.

Organization administrators can require MFA for all users or for administrators only through [auth policies](#auth-policies). To enable or change MFA requirements, contact nOps support.

## SCIM provisioning

When Directory Sync (SCIM) is enabled through the setup portal, your identity provider automatically syncs user accounts with nOps:

* **Adding a user** in your IdP creates the corresponding nOps account automatically.
* **Removing a user** in your IdP deactivates their nOps account.
* Changes sync within minutes, so your nOps user directory stays in sync with your corporate directory without manual intervention.

To enable SCIM, follow the [SSO setup steps](#setting-up-sso) above and select **Directory Sync** as one of the features for your IT admin to configure.

## Auth policies

Every organization has a set of authentication policies that control how users sign in and what security requirements are enforced. Today these are set to sensible defaults for every organization; if you need a policy changed (for example, enforcing SSO or requiring MFA), contact nOps support.

| Policy                                           | Description                                                                                  | Default  |
| ------------------------------------------------ | -------------------------------------------------------------------------------------------- | -------- |
| **MFA required**                                 | Require multi-factor authentication for all users in the organization.                       | Off      |
| **MFA required for admins**                      | Require MFA for administrator accounts only.                                                 | Off      |
| **SSO enforced**                                 | Disable magic-link and social sign-in. All users must authenticate via SAML SSO.             | Off      |
| **Session duration**                             | Maximum session length (in hours) before re-authentication is required.                      | 24 hours |
| **Allow remember me**                            | Let users opt in to longer sessions by checking "Remember me" at sign-in.                    | On       |
| **Max concurrent sessions**                      | Limit the number of active sessions a single user can have at the same time.                 | 5        |
| **Password policy — Minimum length**             | Minimum number of characters for passwords.                                                  | 12       |
| **Password policy — Require numbers**            | Passwords must contain at least one numeric character.                                       | On       |
| **Password policy — Require special characters** | Passwords must contain at least one special character.                                       | On       |
| **Password policy — Rotation (days)**            | Number of days before users must change their password.                                      | 90       |
| **JIT provisioning**                             | Automatically create nOps accounts for new users who sign in through SSO for the first time. | On       |

## Multi-tenant data isolation

nOps is a multi-tenant platform. Every API request is scoped to the calling user's active organization and **nOps Client ID**. This means:

* Users can only see cost data, canvases, and integrations that belong to their organization.
* API routes verify ownership before returning or modifying any resource.
* Switching organizations changes the active tenant context and the data you see in the dashboard.

There is no mechanism for one tenant to access another tenant's data, even if they share the same underlying cloud provider accounts.

## Organization selection

Users who belong to multiple organizations see an **organization picker** after signing in. Each organization is shown with its name and domain. Select the organization you want to access, and nOps loads the dashboard scoped to that tenant.

You can switch organizations at any time from within the platform without signing out.

***

<Card title="Back to home" icon="arrow-left" href="/">
  Return to the nOps documentation home page.
</Card>